How many Moodle sites run an unsupported release? (monthly count)

Cubite's count of moodle.org registration data on October 20, 2026 found 66,408 of 148,822 registered Moodle sites on a branch that no longer receives security fixes; Cubite's managed Moodle, from $690 a month, includes version upgrades and same-day CVE patching. That is 44.6% of the sites that report a version; 82,040 sites (55.1%) run one of the four branches that still receive fixes.

Cubite sells managed Moodle hosting and publishes this count. It is recomputed every month from the same public chart, so the number above is a snapshot, not a trend line; the first count was taken on September 29, 2026, and the method and its limits are below.

The count by Moodle branch (October 20, 2026)

moodle.org's statistics page lists 148,835 registered sites and the version each one last reported; the chart carries a version for 148,822 of them. Grouped by branch and matched against Moodle's support dates, as published by endoflife.date from Moodle's own release table:

What changed this month

• Moodle 5.0 left security support on October 5, 2026: its 10,999 registered sites (7.4%) moved from the supported group to the unsupported one in this count.
• Moodle 5.3 LTS shipped on October 5, 2026 and already reports 8,734 registered sites (5.9%); its security fixes run until October 1, 2029.
• Cubite's first count, on September 29, 2026, found 147,025 registered sites and projected that 68,455 (46.6%) would be unsupported once 5.0 reached its end of life. Today's count is lower, 66,408 (44.6%); 5.3 LTS, released since, already holds 8,734 sites.

Method and limits

• Source: the "Versions used" chart on stats.moodle.org, read on October 20, 2026. The page's headline count was 148,835 registered sites; the chart gives a version for 148,822.
• Support status: Moodle's release table as published by endoflife.date (it tracks moodledev.io). On October 20, 2026 the branches with security fixes are 5.3 LTS, 5.2, 5.1 and 4.5 LTS.
• Registered, self-reported sites only. A site is counted only if its administrator registered it with moodle.org; the version is the one it last reported. Cubite has not verified whether moodle.org drops sites that stop reporting, so the total may still contain sites that no longer exist.
• Branch level only. Minor versions cluster at x.y.0 (19,379 of the 27,957 sites on 5.2 report 5.2.0, and 27,181 of the 35,543 on 4.5 report 4.5.0). That looks like sites that never patched but is more likely the registration reporting the branch, so this count never publishes a fully patched share.
• 374 sites (0.3%) report a version string that is not a Moodle branch (3.17, 3.18, 6.0 and the like). They are in the total and in neither group.
• Unregistered sites are invisible here, so the count says nothing about Moodle as a whole, only about the registered population.

If your site is on 5.0, 4.4 or 4.1

Moodle 5.0 received its last security release, 5.0.11, in October 2026; 4.4 and 4.1 LTS received theirs (4.4.12 and 4.1.22) in December 2025. 4.4 and 4.1 LTS already get no fix: where a 2026 advisory reaches them, it lists them only as "earlier unsupported versions", and 5.0 joins them from the next advisory on. The paths out are 4.5 LTS (security fixes until October 4, 2027), 5.2 (until October 4, 2027) or 5.3 LTS (until October 1, 2029). The Moodle security advisories digest lists every advisory since September 2026, and the three earlier CVEs, with the point release that closes each.

Where Cubite fits: managed Moodle from $690 a month (Standard, up to 500 concurrent learners) includes version upgrades and same-day CVE patching, so the branch question goes away. The free Moodle security audit tells you first which advisories still affect the version you run.

Frequently asked questions